@codemod/arm-role-assignment-broad-scope-audit
Detect Azure Resource Manager templates and Bicep-equivalent ARM JSON that create Microsoft.Authorization/roleAssignments resources whose effective scope is the entire subscription or a management group, then report findings and metrics with remediation guidance to move assignments to narrower resource-group or resource scopes where possible.
This package is read-only. It does not rewrite source files.
Installation
Usage
The codemod scans ARM JSON deployment templates for deployable Microsoft.Authorization/roleAssignments resources and reports one finding per role assignment whose effective scope is:
- The entire subscription
- A management group
It classifies findings by scope source:
explicitScopePropertyinheritedTargetScopeextensionResourceTargetresourceIdHelperliteralResourceId
It deterministically evaluates common ARM expressions used to build scope ids, including:
subscription()subscriptionResourceId()managementGroupResourceId()extensionResourceId()resourceId()when the base scope can be resolved staticallytenantResourceId()format()andconcat()when all inputs are deterministic
It excludes:
- ARM parameter files
- Non-template JSON
- Role assignments narrowed to a resource group or specific resource
- Cases whose scope cannot be resolved statically
Each finding includes the file path, JSON path, resource name expression, effective scope classification, scope source, normalized roleDefinitionId when available, evidence, and remediation guidance.
Metrics
The codemod emits these codemod:metrics counters:
arm_role_assignments_scanned_totalarm_role_assignments_broad_scope_totalarm_role_assignments_subscription_scope_totalarm_role_assignments_management_group_scope_totalarm_role_assignments_unclassified_scope_totalarm_role_assignments_by_scope_source_totalarm_role_assignments_broad_by_scope_source_totalarm_role_assignments_by_role_definition_totalarm_role_assignments_broad_by_role_definition_totalarm_role_assignments_files_with_broad_scope_totalarm_role_assignments_findings_total
Remediation
Prefer RBAC assignments at resource-group or individual-resource scope. Keep subscription or management-group assignments only when organization-wide administration is explicitly intended, documented, and reviewed.
Development
License
MIT